In some environments security programs scan build artifacts, vm disks, s3 buckets, etc.
If a piece of software is using/importing pycryptodome then the python package is included in the artifact. pip install pycryptodome includes the SelfTest directory within the distribution. Within the SelfTest/PublicKey there are a few files test_import_<algorithm>.py which include test private keys hardcoded in the source.
The security software is detecting the presence of these private keys and raising an alert. Does it make sense to include the test files within the PYPI package?
Can these be removed to prevent security scans from detecting them.
In some environments security programs scan build artifacts, vm disks, s3 buckets, etc.
If a piece of software is using/importing
pycryptodomethen the python package is included in the artifact.pip install pycryptodomeincludes theSelfTestdirectory within the distribution. Within theSelfTest/PublicKeythere are a few filestest_import_<algorithm>.pywhich include test private keys hardcoded in the source.The security software is detecting the presence of these private keys and raising an alert. Does it make sense to include the test files within the PYPI package?
Can these be removed to prevent security scans from detecting them.